Firewall IP Address Range Allowlisting for cdn.cribl.io

Question

What IP address range does the cdn.cribl.io domain use, and how can I safely allowlist it in a firewall or AWS security group for Cribl Stream or Cribl Edge traffic?

Environment

• Cribl Stream or Cribl Edge, any supported version
• Components that use cdn.cribl.io for bootstrapping, configuration bundle downloads, telemetry, or software upgrades (for example, Leaders, Workers, Edge nodes, or Cribl.Cloud–connected deployments)
• Network with outbound firewall, security group, or other egress control that prefers or requires explicit allowlisting of external destinations (for example, AWS security groups or AWS Network Firewall)

Answer

There is no single, static, Cribl-owned IP range for cdn.cribl.io that you can safely hardcode into a firewall or AWS security group. The cdn.cribl.io hostname is implemented as a content delivery network (CDN) endpoint in front of Cribl’s CDN storage, so its IP addresses are drawn from the CDN provider’s shared edge network and are controlled by that provider rather than Cribl.

Because of this, the backing IPs can change over time and are not specific to a small, fixed set that Cribl can publish or guarantee.

How to restrict access

To safely restrict outbound access while still allowing required Cribl functionality:

1. Prefer FQDN/domain allowlisting for cdn.cribl.io.
2. Configure your firewall, proxy, or “AWS Network Firewall” to allow HTTPS (port 443) egress from the relevant hosts to the hostname cdn.cribl.io, instead of trying to maintain a static IP range. This approach tolerates CDN IP changes without additional maintenance.
3. Use an egress proxy or NGFW that supports URL or domain-based rules.
4. If your perimeter only exposes a limited set of outbound destinations, deploy an egress proxy or next-generation firewall (including AWS Network Firewall) that can allowlist cdn.cribl.io by hostname or URL. Point your Cribl nodes at that proxy so they reach cdn.cribl.io indirectly, without embedding IP ranges in every security group.
5. In tightly locked-down environments, rely on non-CDN paths where possible.
6. In some architectures (for example, Cribl Edge connected to a Leader), configuration bundles and software upgrades can fall back from the CDN to the Leader over the control-plane port when the CDN is unreachable. In those cases, you can choose to block cdn.cribl.io entirely and rely on the Leader path, at the cost of foregoing CDN acceleration.